Primary General Studies | Digital Literacy and Online Safety Prep Guide (for tutors) | Four defences, password maths and six real traps

2026-11-14

Tutor lesson-prep guides · Primary General Studies

When a pupil says my password is my birthday, the missing piece is not effort but a number: nobody told them an attacker can try a hundred guesses a second. This lesson turns that risk into arithmetic, then into four defences a child can actually say out loud.

Objectives — By the end pupils can: (1) explain why an eight-digit number is weak by comparing combinations of four and eight digits; (2) sort six personal details into three levels (public, trusted only, never share); (3) name the four marks of a scam message and circle three suspicious points in two sample messages.

01 Prerequisites (3-minute check)

If any of these fails, fix it before the lesson starts.

Skill	Quick check	Pass mark
Powers of ten	How many combinations does a 4-digit PIN have?	10 to the power 4, that is 10000
MB and GB	How many MB are in 1 GB?	1024 MB, not 1000
Percentages	What is 20 as a percentage of 100?	20 percent

02 Lesson flow (45 minutes)

Time	Stage	Tutor does	Student does
0-5 min	Two opening questions	Ask how their password is built and who has asked for a code	Hands up and one real example each
5-15 min	Password arithmetic	Write 4-digit and 8-digit combinations on the board and compute together	Compute 10 to the power 4 and 8
15-23 min	Three-level sorting	Show six personal-detail cards and model the sort	Place each card and justify it
23-32 min	Four scam marks	Read two fake messages and underline urgent, money, code, odd link	Underline on their own copy
32-40 min	Storage and screen time	Convert a 20 MB clip at 10 Mbps and count photos per GB	Get 16 seconds and 256 photos
40-45 min	Exit check	Hand out three questions and mark together	Answer and self-mark

03 Teaching script (read it out)

Scene 1: Passwords: length is the strength

Start with two numbers. A four-digit PIN has 10000 combinations. An eight-digit PIN has 100000000. At 100 guesses per second the second one still takes about 11.57 days. Now ask what one extra letter does: it does not add one option, it multiplies by 26.

So teach length first, symbols second. Pupils who add one symbol to a short password have gained very little.

Longer beats more symbols, because combinations multiply with each digit

Scene 2: Privacy: three levels

Write six details on cards: name, school, class, birthday, home address, identity number. Level one, public, is the name alone. Level two, trusted people only, is school, class and birthday. Level three, never share, is the address and the identity number.

The common misconception is that hiding the full name is enough. It is not: school plus birthday is often enough to impersonate a child. Show once how two level-two details combine into level three.

Address and identity number are never share; school plus birthday is already risky

Scene 3: Scam marks and storage maths

Almost every scam message carries at least one mark: urgency, a request for money, a request for a verification code, or a slightly wrong web address. Read two messages and mark them together.

Close with numbers: a 20 MB clip at 10 Mbps uploads in 16 seconds, 1 GB holds 256 photos of 4 MB, and a 32 GB phone holds about 8192 photos. Let pupils decide what to delete rather than announcing a limit.

Urgent, money, code, odd link: any one of them means stop

04 Question types and worked steps

Type	Example	Steps	Answer
Calculation	How many times more combinations do 8 digits give than 4?	Write both as powers of ten, then divide	10000 times, ten thousand times
Sorting	Sort six details into three levels	Ask whether sharing lets someone impersonate you	Address and identity number go to level three
Judgement	Which of two messages is a scam	Check the four marks one by one	The one asking for a code
Conversion	How long to upload 20 MB at 10 Mbps	Multiply MB by 8 to get megabits, then divide	16 seconds

Sanity check (teach this): Sanity check: no real website or brand is named, so the page cannot be read as an instruction; the arithmetic stays at powers of ten, which is P4 level; every figure written here was computed by script first; only one percentage question appears, so no compound interest or probability sneaks in; no daily screen-time limit is given, because no single standard exists, only the conversion method.

05 Independent practice (3 questions)

Question	Answer	What to watch
Combinations	How many combinations does a six-digit PIN have?	Check they use 10 to the power 6, not 6 times 10
Three levels	Sort eight personal details	Check nobody puts birthday in level one
Scam marks	Circle suspicious parts of three messages	Check they find urgency, not only odd links

06 Common mistakes and what to say

Mistake	Student writes	Say this
Believing symbols are enough	My password is P@ss1!	One symbol adds a few dozen options; two more letters add hundreds of times more. Start with length.
Reading a code to a caller	The bank called so I read the code	A verification code is your front-door key. Nobody gets it, not even a bank.
Posting school and class	My profile lists my school and class	Two ordinary details combine into identification. Keep level two off the internet.
Reusing one password	I use the same password everywhere	One leaked site opens every door. Use at least three separate groups.

07 Homework (paper, section and question numbers)

Primary General Studies chapter index — All chapters in this subject
All prep guides index — Chapters in other subjects
Redo this chapter — One question from each type

08 Exit check (last 5 minutes)

Question	Answer	Decision
Combinations	An 8-digit PIN gives 10 to the power 8 combinations	Wrong means reteach act one arithmetic
Three levels	Home address is level three	Wrong means redo the sorting cards
Scam marks	Name at least three of the four	Only one means reread act three

09 Tutor FAQ

Should I teach VPNs or firewalls?

No. Primary needs four defences only; network security belongs to secondary ICT.

May I name social platforms?

No. Say any social site, otherwise the lesson becomes a walkthrough of one app.

Should I give a screen-time number?

No. There is no single standard; teach the conversion and let pupils log their own use.

Find a tutor — free Tutor Registration →

A TutorZone lesson-prep guide. Written by the TutorZone team; questions and lesson flow are original and are not taken from any school or publisher material.